quasar | 317b2e1eb9a1d427e165f38f2a44bd90329b729de3f7a2d19c511e023eab73a8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240817-cb23ss1aqa
SHA256 317b2e1eb9a1d427e165f38f2a44bd90329b729de3f7a2d19c511e023eab73a8
MD5 771320cba78821e9c290263827e4d32a
SHA1 9a39d6397eaf5e44a51d99a246a313decb113907
SHA512 d14b207cfacdbf3bc1b2516ed677e83ace171258995f4a85dc0f79aecd296126d76fa02c4c28fc9983bece819c528f0e6ac43225cb635c1df37070a3da8adec1
SSDEEP 49152:e+w9o5EqFBnmhVXIlQVL/I2jCQTHHB72eh2NTQ:e+vEqFBnmhVXIluD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar skids discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SKIDS

147.185.221.22:6712

Mutex

545a5892-0ce9-4925-83a7-479d8b964612

Attributes

encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
install_name
Windows Host Process.exe
log_directory
Windows-Logs
reconnect_delay
3000
startup_key
Windows Host Process
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/748-1-0x0000000000260000-0x000000000058C000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023415-6.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Windows Host Process.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	Windows Host Process.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Client-built.exe
File opened for modification	C:\Windows\system32\Windows	Client-built.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Windows Host Process.exe
File opened for modification	C:\Windows\system32\Windows	Windows Host Process.exe
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File created	C:\Windows\system32\Windows\Windows Host Process.exe	Client-built.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2364	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2364	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2432	schtasks.exe
2528	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	Client-built.exe
Token: SeDebugPrivilege	1916	Windows Host Process.exe
Token: SeBackupPrivilege	4272	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	4272	SystemSettingsAdminFlows.exe
Token: SeSystemEnvironmentPrivilege	4272	SystemSettingsAdminFlows.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1916	Windows Host Process.exe
1916	Windows Host Process.exe
1916	Windows Host Process.exe
1916	Windows Host Process.exe
1916	Windows Host Process.exe
4272	SystemSettingsAdminFlows.exe
4272	SystemSettingsAdminFlows.exe
1916	Windows Host Process.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1916	Windows Host Process.exe
1916	Windows Host Process.exe
1916	Windows Host Process.exe
1916	Windows Host Process.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1916	Windows Host Process.exe
4272	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2432	748	Client-built.exe	86
PID 748 wrote to memory of 2432	748	Client-built.exe	86
PID 748 wrote to memory of 1916	748	Client-built.exe	88
PID 748 wrote to memory of 1916	748	Client-built.exe	88
PID 1916 wrote to memory of 2528	1916	Windows Host Process.exe	91
PID 1916 wrote to memory of 2528	1916	Windows Host Process.exe	91
PID 1916 wrote to memory of 884	1916	Windows Host Process.exe	101
PID 1916 wrote to memory of 884	1916	Windows Host Process.exe	101
PID 1916 wrote to memory of 4748	1916	Windows Host Process.exe	116
PID 1916 wrote to memory of 4748	1916	Windows Host Process.exe	116
PID 1916 wrote to memory of 4592	1916	Windows Host Process.exe	118
PID 1916 wrote to memory of 4592	1916	Windows Host Process.exe	118
PID 4592 wrote to memory of 1596	4592	cmd.exe	120
PID 4592 wrote to memory of 1596	4592	cmd.exe	120
PID 4592 wrote to memory of 2364	4592	cmd.exe	121
PID 4592 wrote to memory of 2364	4592	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2432
- C:\Windows\system32\Windows\Windows Host Process.exe
  "C:\Windows\system32\Windows\Windows Host Process.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- - C:\Windows\SYSTEM32\reagentc.exe
    "reagentc" /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "Windows Host Process" /f
    3⤵
    PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7cdEXPNEuleT.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1596
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2364

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7cdEXPNEuleT.bat

Path C:\Users\Admin\AppData\Local\Temp\7cdEXPNEuleT.bat
Size 215B
SHA256 bb6240004953e85794b6820385798d52346b2a30afcef890f81f55efb9117110
MD5 51711d6ef66386eaa93e2d96ae7e1f1f
SHA1 0de6d0b027c5ada8648dbee3be1421fafbce2496
SHA512 4f35bfe3a2dfb662e544fe2aa84064aceac7d8b814e30afefcc82165e4f4394d519dd4be4f3ad99a50dc3d17355ebf5920e28836440593de8f25461f87ad8b20
MD5 SHA1 SHA512

Submit Download

Windows Host Process.exe

Path C:\Windows\System32\Windows\Windows Host Process.exe
Size 3.1MB
SHA256 317b2e1eb9a1d427e165f38f2a44bd90329b729de3f7a2d19c511e023eab73a8
MD5 771320cba78821e9c290263827e4d32a
SHA1 9a39d6397eaf5e44a51d99a246a313decb113907
SHA512 d14b207cfacdbf3bc1b2516ed677e83ace171258995f4a85dc0f79aecd296126d76fa02c4c28fc9983bece819c528f0e6ac43225cb635c1df37070a3da8adec1
SSDEEP 49152:e+w9o5EqFBnmhVXIlQVL/I2jCQTHHB72eh2NTQ:e+vEqFBnmhVXIluD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 894ee2b19608d10df4bf8b8f5bbcf40ce38c09c1f4c5543b6164f40c04bb270d
MD5 44b2da39ceb2c183d5dcd43aa128c2dd
SHA1 502723d48caf7bb6e50867685378b28e84999d8a
SHA512 17744dcaddb49f17fe67dc3a579f4df2b6c2b196776330b71edfc58b37d1f8ae477bfb718d2f23401b78b789b7f984b19341f50fbecfba1bc101f596dee40604
MD5 SHA1 SHA512

Submit Download

memory/748-0-0x00007FFAF38B3000-0x00007FFAF38B5000-memory.dmp

Download

memory/748-1-0x0000000000260000-0x000000000058C000-memory.dmp

Download

memory/748-2-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

memory/748-9-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

memory/1916-13-0x000000001C230000-0x000000001C2E2000-memory.dmp

Download

memory/1916-12-0x000000001C120000-0x000000001C170000-memory.dmp

Download

memory/1916-16-0x000000001C1B0000-0x000000001C1C2000-memory.dmp

Download

memory/1916-17-0x000000001C930000-0x000000001C96C000-memory.dmp

Download

memory/1916-18-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

memory/1916-19-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

memory/1916-24-0x000000001DF00000-0x000000001E428000-memory.dmp

Download

memory/1916-11-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

memory/1916-49-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

memory/1916-10-0x00007FFAF38B0000-0x00007FFAF4371000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads